diff --git a/.github/workflows/public-repo-guard.yml b/.github/workflows/public-repo-guard.yml
index bd7a962..ea0eb88 100644
--- a/.github/workflows/public-repo-guard.yml
+++ b/.github/workflows/public-repo-guard.yml
@@ -75,8 +75,12 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
-          # Nothing in this job pushes or calls the API, so the token has no
-          # business lingering in .git/config while repo-checked-out scripts run.
+          # Checkout defaults to persisting the job token for later steps: since v6 it
+          # lives in a file under $RUNNER_TEMP referenced from .git/config, no longer in
+          # .git/config itself. It is still a live credential in the job, and this job
+          # downloads a third-party binary (gitleaks, below) and runs it over the whole
+          # tree. Nothing here pushes -- the scan is `--no-git` over the working tree --
+          # so no step needs authenticated Git; drop it. (zizmor: artipacked)
           persist-credentials: false
 
       # gitleaks' GitHub Action requires a paid license for organizations; the CLI